@capybara-hq/kernel 0.1.0-rc.22 → 0.1.0-rc.23

package/dist/identity/settings.d.ts

@@ -1,8 +1,10 @@
 import { z } from "zod";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type PlatformTiers, type PlatformTiersPatch, type PlatformTiersStored, type PlatformTiersView } from "../sandbox/platform-tiers.js";
 import { type UiArrangement } from "../ui/arrangement.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
@@ -105,6 +107,14 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
+/**
+ * What `GET /api/v1/admin/settings` answers: the stored settings, and the platform's sandbox tiers
+ * as they are in effect with where each field comes from (`env` / `file` / `nacos`: the startup
+ * config, read-only here; `db`: chosen in the admin console; `default`).
+ */
+export type DeploymentSettingsView = DeploymentSettings & {
+    sandboxTiers: PlatformTiersView;
+};
 /**
  * 设置的修改（PUT /api/v1/admin/settings 的 body）：只改给出的键。
  * `runConcurrencyOverrides` 按组织合并：值为正整数 → 设置该组织的上限；值为 null → 删除该组织的覆盖
@@ -147,6 +157,19 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
         disabled: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    sandboxTiers: z.ZodOptional<z.ZodObject<{
+        max: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>>;
+        default: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            dev: "dev";
+            open: "open";
+            strict: "strict";
+        }>>>;
+        allowUnsandboxed: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DeploymentSettingsPatch = z.infer<typeof DEPLOYMENT_SETTINGS_PATCH>;
 /**
@@ -198,7 +221,29 @@ export declare class SettingsService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly log;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">);
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    private readonly config;
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">, 
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    config: Pick<KernelConfigService, "get" | "fieldSource">);
+    /** The settings with the platform's sandbox tiers in effect and their sources. */
+    view(): Promise<DeploymentSettingsView>;
+    private tiersView;
+    /**
+     * The refusals of a `sandboxTiers` change against the stored choice: a field set in the
+     * startup config (`deployment.setting_readonly`), a default above the max
+     * (`validation_failed`), and with `onlyNarrows` (an API token, the Platform tool) any widening:
+     * a higher max or default, unsandboxed allowed, in effect or in the stored choice (which
+     * applies once the startup config stops setting a field). Returns the next stored choice and
+     * the effective tiers before and after.
+     */
+    checkSandboxTiers(patch: PlatformTiersPatch, opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<{
+        next: PlatformTiersStored;
+        before: PlatformTiers;
+        after: PlatformTiers;
+    }>;
     /**
      * Reads every setting, in the context's transaction when there is one (a caller holding a
      * transaction connection does not take a second one from the pool). Each key is validated on
@@ -206,9 +251,14 @@ export declare class SettingsService {
      * valid keys apply; unknown keys (written by a newer version) are ignored.
      */
     get(): Promise<DeploymentSettings>;
-    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    /**
+     * Updates settings under the super admin lock, re-checking the actor (else `forbidden`).
+     * `onlyNarrows` (an API token, the Platform tool): `sandboxTiers` may only narrow.
+     */
     update(patch: DeploymentSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail?: Record<string, unknown>): Promise<DeploymentSettings>;
+    auditDetail?: Record<string, unknown>, opts?: {
+        onlyNarrows?: boolean;
+    }): Promise<DeploymentSettingsView>;
     private write;
 }

package/dist/identity/settings.js

@@ -11,10 +11,12 @@ import { EXTENSION_NAME_RE } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { applyPlatformTiersPatch, chosenPlatformDefault, PLATFORM_TIER_FIELDS, PLATFORM_TIERS_PATCH, PLATFORM_TIERS_SETTING, platformTiersWiden, readStoredPlatformTiers, resolvePlatformTiers, } from "../sandbox/platform-tiers.js";
 import { assertPlatformDefaultEligible, lockThemeShared } from "../themes/theme-state.js";
 import { mergeArrangement, UiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { audit } from "./audit.js";
@@ -153,6 +155,7 @@ export const DEPLOYMENT_SETTINGS = z.object({
     clientExtensions: ClientExtensionsSetting.default(clientExtensionsDefault),
 });
 const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
+const tierWidenRefused = () => new ApiError("deployment.sandbox_tier_not_allowed", "Raising the platform's sandbox level (sandboxTiers) needs a super admin in the admin console; an API token or the Platform tool may only lower it.");
 /**
  * 设置的修改（PUT /api/v1/admin/settings 的 body）：只改给出的键。
  * `runConcurrencyOverrides` 按组织合并：值为正整数 → 设置该组织的上限；值为 null → 删除该组织的覆盖
@@ -198,6 +201,14 @@ export const DEPLOYMENT_SETTINGS_PATCH = z
         message: "give enabled, disabled or both",
     })
         .optional(),
+    /**
+     * The platform's sandbox tiers (sandbox dev tiers spec §4.1): each given field replaces the
+     * stored one, null clears it (back to the default: max dev, default dev, unsandboxed allowed).
+     * A field set in the startup config is read-only (409 `deployment.setting_readonly`); the
+     * default may not be above the max; an API token or the Platform tool may only narrow (400
+     * `deployment.sandbox_tier_not_allowed`).
+     */
+    sandboxTiers: PLATFORM_TIERS_PATCH.optional(),
 })
     .strict();
 /**
@@ -350,11 +361,66 @@ let SettingsService = class SettingsService {
     txHost;
     adminLock;
     log;
-    constructor(db, txHost, adminLock, log) {
+    config;
+    constructor(db, txHost, adminLock, log, 
+    /** The startup config's `sandbox.tiers`, which wins over the stored choice. */
+    config) {
         this.db = db;
         this.txHost = txHost;
         this.adminLock = adminLock;
         this.log = log;
+        this.config = config;
+    }
+    /** The settings with the platform's sandbox tiers in effect and their sources. */
+    async view() {
+        const [settings, stored] = await Promise.all([
+            this.get(),
+            readStoredPlatformTiers(this.db.db, this.log),
+        ]);
+        return { ...settings, sandboxTiers: this.tiersView(stored) };
+    }
+    tiersView(stored) {
+        const config = this.config.get().sandbox.tiers;
+        const sources = Object.fromEntries(PLATFORM_TIER_FIELDS.map((f) => [
+            f,
+            this.config.fieldSource(`sandbox.tiers.${f}`) ??
+                (stored[f] !== undefined ? "db" : "default"),
+        ]));
+        return { ...resolvePlatformTiers(config, stored), sources };
+    }
+    /**
+     * The refusals of a `sandboxTiers` change against the stored choice: a field set in the
+     * startup config (`deployment.setting_readonly`), a default above the max
+     * (`validation_failed`), and with `onlyNarrows` (an API token, the Platform tool) any widening:
+     * a higher max or default, unsandboxed allowed, in effect or in the stored choice (which
+     * applies once the startup config stops setting a field). Returns the next stored choice and
+     * the effective tiers before and after.
+     */
+    async checkSandboxTiers(patch, opts = {}) {
+        const readonly = PLATFORM_TIER_FIELDS.filter((f) => patch[f] !== undefined && this.config.fieldSource(`sandbox.tiers.${f}`) !== undefined);
+        if (readonly.length > 0) {
+            throw new ApiError("deployment.setting_readonly", `These sandbox tier settings are set in the startup config (file, Nacos or environment) and are read-only here: ${readonly.map((f) => `sandbox.tiers.${f}`).join(", ")}`, readonly.map((f) => ({
+                path: `sandboxTiers.${f}`,
+                source: this.config.fieldSource(`sandbox.tiers.${f}`),
+            })));
+        }
+        const config = this.config.get().sandbox.tiers;
+        const stored = await readStoredPlatformTiers(this.db.db, this.log);
+        const next = applyPlatformTiersPatch(stored, patch);
+        const before = resolvePlatformTiers(config, stored);
+        const after = resolvePlatformTiers(config, next);
+        const chosen = chosenPlatformDefault(config, next);
+        if ((patch.max !== undefined || patch.default !== undefined) && chosen !== after.default) {
+            throw new ApiError("validation_failed", `The default sandbox tier (${chosen}) cannot be above the highest (${after.max}); lower sandboxTiers.default as well`, [{ path: "sandboxTiers.default", message: `must be at most ${after.max}` }]);
+        }
+        if (opts.onlyNarrows) {
+            const none = {};
+            if (platformTiersWiden(before, after) ||
+                platformTiersWiden(resolvePlatformTiers(none, stored), resolvePlatformTiers(none, next))) {
+                throw tierWidenRefused();
+            }
+        }
+        return { next, before, after };
     }
     /**
      * Reads every setting, in the context's transaction when there is one (a caller holding a
@@ -382,18 +448,21 @@ let SettingsService = class SettingsService {
         }
         return out;
     }
-    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    /**
+     * Updates settings under the super admin lock, re-checking the actor (else `forbidden`).
+     * `onlyNarrows` (an API token, the Platform tool): `sandboxTiers` may only narrow.
+     */
     async update(patch, actorAccountId, actorTokenId, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
-    auditDetail) {
+    auditDetail, opts = {}) {
         const check = DEPLOYMENT_SETTINGS_PATCH.safeParse(patch);
         if (!check.success) {
             throw new ApiError("validation_failed", "Invalid deployment settings", check.error.issues.map((i) => ({ path: i.path.join("."), message: i.message })));
         }
-        await this.write(check.data, actorAccountId, actorTokenId, auditDetail);
-        return this.get();
+        await this.write(check.data, actorAccountId, actorTokenId, auditDetail, opts);
+        return this.view();
     }
-    async write(patch, actorAccountId, actorTokenId, auditDetail) {
+    async write(patch, actorAccountId, actorTokenId, auditDetail, opts) {
         await this.adminLock.lockAndAuthorize(actorAccountId);
         // The super admin lock serializes every settings write: the current overrides are read
         // and merged under it, so no concurrent change is lost
@@ -452,7 +521,16 @@ let SettingsService = class SettingsService {
                 next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
             }
         }
-        for (const [key, value] of Object.entries(next)) {
+        // the platform's sandbox tiers: checked against the stored choice under the lock; lowering
+        // the max needs no org rewrite, the effective policy cuts every org's ceiling and default
+        let tiersChange;
+        const writes = Object.entries(next);
+        if (patch.sandboxTiers !== undefined) {
+            const r = await this.checkSandboxTiers(patch.sandboxTiers, opts);
+            tiersChange = { before: r.before, after: r.after };
+            writes.push([PLATFORM_TIERS_SETTING, r.next]);
+        }
+        for (const [key, value] of writes) {
             if (value === undefined)
                 continue;
             const json = JSON.stringify(value);
@@ -468,7 +546,11 @@ let SettingsService = class SettingsService {
             actorAccountId,
             ...(actorTokenId !== undefined && { actorTokenId }),
             action: "deployment.settings.updated",
-            detail: { ...patch, ...auditDetail },
+            detail: {
+                ...patch,
+                ...(tiersChange !== undefined && { sandboxTiersEffective: tiersChange }),
+                ...auditDetail,
+            },
         });
     }
 };
@@ -480,6 +562,7 @@ SettingsService = __decorate([
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(SuperAdminLock)),
-    __param(3, Inject(KERNEL_LOGGER))
+    __param(3, Inject(KERNEL_LOGGER)),
+    __param(4, Inject(KernelConfigService))
 ], SettingsService);
 export { SettingsService };

package/dist/infra/config/kernel-config.service.d.ts

@@ -15,6 +15,13 @@ export declare class KernelConfigService {
     private readonly listeners;
     constructor(input: KernelConfigInput, log: KernelLogger);
     get(): KernelConfig;
+    /**
+     * Where the current value of a field without a schema default comes from: `env` when an
+     * environment variable sets it, else the config source (`file` / `nacos`) when it is set at all;
+     * undefined when nothing sets it (a layer below the startup config decides, e.g. the deployment
+     * settings for `sandbox.tiers.*`). Such fields are read-only in the admin console.
+     */
+    fieldSource(path: string): "env" | "file" | "nacos" | undefined;
     /** Subscribes to applied changes (hot fields only); returns the unsubscribe function. */
     onChange(listener: ConfigChangeListener): () => void;
     /**

package/dist/infra/config/kernel-config.service.js

@@ -8,9 +8,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from "@nestjs/common";
+import { envOverrides } from "../../config/env.js";
 import { changedPaths, configFields, getPath, secretValues, setPath } from "../../config/fields.js";
 import { resolveConfig } from "../../config/load.js";
 import { KernelConfigSchema } from "../../config/schema.js";
+import { configSourceKind } from "../../config/sources.js";
 import { KERNEL_CONFIG_INPUT, KERNEL_LOGGER } from "../tokens.js";
 /**
  * Appliers of the hot-reloadable fields: the key is a dotted path marked `hot` in the schema. A
@@ -101,6 +103,24 @@ let KernelConfigService = class KernelConfigService {
     get() {
         return this.current;
     }
+    /**
+     * Where the current value of a field without a schema default comes from: `env` when an
+     * environment variable sets it, else the config source (`file` / `nacos`) when it is set at all;
+     * undefined when nothing sets it (a layer below the startup config decides, e.g. the deployment
+     * settings for `sandbox.tiers.*`). Such fields are read-only in the admin console.
+     */
+    fieldSource(path) {
+        if (getPath(this.current, path) === undefined)
+            return undefined;
+        let fromEnv = false;
+        try {
+            fromEnv = getPath(envOverrides(this.env), path) !== undefined;
+        }
+        catch {
+            // conflicting variables fail the start; a later change here only loses the label
+        }
+        return fromEnv ? "env" : configSourceKind(this.env);
+    }
     /** Subscribes to applied changes (hot fields only); returns the unsubscribe function. */
     onChange(listener) {
         this.listeners.add(listener);

package/dist/local-devices/local-device-gateway.d.ts

@@ -55,6 +55,8 @@ declare class DeviceConnection {
     private chain;
     /** Resolves once the lease is handed back (or was never held). */
     private released;
+    /** The hello's record, then each policy frame's, one after another (never rejects). */
+    private recorded;
     constructor(gw: LocalDeviceGateway, socket: WebSocket, identity: MachineIdentity, credential: string);
     get deviceId(): string;
     start(): void;
@@ -101,7 +103,7 @@ declare class DeviceConnection {
  * sockets are this process's own; everything other replicas need is in Redis.
  */
 export declare class LocalDeviceGateway {
-    readonly machines: Pick<MachinesService, "authenticate" | "recordHello" | "touch">;
+    readonly machines: Pick<MachinesService, "authenticate" | "recordHello" | "recordPolicy" | "touch">;
     readonly locks: Pick<LockService, "hold">;
     readonly bus: ExtensionContext["bus"];
     readonly redis: Redis;
@@ -112,7 +114,7 @@ export declare class LocalDeviceGateway {
     private stopping;
     /** How often connections are pinged ({@link PING_INTERVAL_MS}; a test seam). */
     pingIntervalMs: number;
-    constructor(machines: Pick<MachinesService, "authenticate" | "recordHello" | "touch">, locks: Pick<LockService, "hold">, bus: ExtensionContext["bus"], redis: Redis, config: KernelConfigService, log: Pick<KernelLogger, "info" | "warn">);
+    constructor(machines: Pick<MachinesService, "authenticate" | "recordHello" | "recordPolicy" | "touch">, locks: Pick<LockService, "hold">, bus: ExtensionContext["bus"], redis: Redis, config: KernelConfigService, log: Pick<KernelLogger, "info" | "warn">);
     graceMs(): number;
     leaseTtlMs(): number;
     maxFrameBytes(): number;

package/dist/local-devices/local-device-gateway.js

@@ -114,6 +114,8 @@ class DeviceConnection {
     chain = Promise.resolve();
     /** Resolves once the lease is handed back (or was never held). */
     released;
+    /** The hello's record, then each policy frame's, one after another (never rejects). */
+    recorded = Promise.resolve();
     constructor(gw, socket, identity, credential) {
         this.gw = gw;
         this.socket = socket;
@@ -174,20 +176,43 @@ class DeviceConnection {
             }
             clearTimeout(this.helloTimer);
             this.state = "claiming";
-            if (!(await this.claim()))
-                return;
-            try {
-                // the raw summary too: the frame parser drops one it cannot read whole, and its
-                // isolation must still reach the kernel
-                const rawPolicy = JSON.parse(text).policy;
-                await this.gw.machines.recordHello(this.identity.machineId, frame, rawPolicy);
-            }
-            catch (e) {
-                this.gw.log.warn("could not record a device hello", {
-                    deviceId: this.deviceId,
-                    error: errMsg(e),
-                });
-            }
+            // the raw summary too: the frame parser drops one it cannot read whole, and its
+            // isolation must still reach the kernel
+            const rawPolicy = JSON.parse(text).policy;
+            // set before the first await: a policy frame that follows is recorded after the hello
+            this.recorded = (async () => {
+                if (!(await this.claim()))
+                    return;
+                try {
+                    await this.gw.machines.recordHello(this.identity.machineId, frame, rawPolicy);
+                }
+                catch (e) {
+                    this.gw.log.warn("could not record a device hello", {
+                        deviceId: this.deviceId,
+                        error: errMsg(e),
+                    });
+                }
+            })();
+            await this.recorded;
+            return;
+        }
+        if (frame.type === "policy" && this.state !== "hello") {
+            // after the hello's record and the earlier policy frames, in the order they came
+            const rawPolicy = JSON.parse(text).policy;
+            this.recorded = this.recorded.then(async () => {
+                if (this.state === "closed")
+                    return;
+                try {
+                    await this.gw.machines.recordPolicy(this.identity.machineId, frame.policy, rawPolicy);
+                }
+                catch (e) {
+                    this.gw.log.warn("could not record a device policy change", {
+                        deviceId: this.deviceId,
+                        error: errMsg(e),
+                    });
+                }
+            });
+            await this.recorded;
             return;
         }
         if (frame.type !== "res" || this.state === "hello") {

package/dist/local-devices/machines.d.ts

@@ -97,6 +97,22 @@ export declare class MachinesService {
      * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change.
      */
     recordHello(machineId: string, hello: DeviceHello, rawPolicy?: unknown): Promise<void>;
+    /**
+     * Stores the local policy summary a connected program pushed after its hello (a `policy` frame:
+     * its policy file changed on the machine, its localhost proxy guard flipped, a new tier
+     * ceiling), read and audited as the hello's ({@link recordHello}): an unreadable summary keeps
+     * its isolation alone (`rawPolicy`), a changed isolation is audited `device.isolation_reported`.
+     * The next sandbox call then records a new `device_paths` event when the facts the model is told
+     * changed. A revoked machine is left alone.
+     */
+    recordPolicy(machineId: string, summary: DeviceLocalPolicySummary | undefined, rawPolicy?: unknown): Promise<void>;
+    /**
+     * The summary to store for one a program reported (hello or `policy` frame): the parsed one,
+     * else its raw isolation alone, else null. Audits `device.isolation_reported` when the isolation
+     * differs from the stored one (none stored counts as `sandbox`). Runs in the caller's
+     * transaction, with the machine's row locked.
+     */
+    private reportedPolicy;
     /** Marks the machine seen (a ping); writes at most once every 60 seconds. */
     touch(machineId: string): Promise<void>;
     /**

package/dist/local-devices/machines.js

@@ -207,19 +207,7 @@ let MachinesService = class MachinesService {
                     .execute();
             }
         }
-        const summary = localPolicyOf(hello.policy);
-        const isolation = summary?.isolation ?? isolationOf(rawPolicy);
-        const policy = summary ?? (isolation === null ? null : { isolation });
-        const before = isolationOf(self.local_policy) ?? "sandbox";
-        if (isolation !== null && isolation !== before) {
-            await audit(this.db.db, {
-                actorAccountId: self.account_id,
-                orgId: self.org_id,
-                action: "device.isolation_reported",
-                target: self.device_id,
-                detail: { machineId, isolation, previous: before },
-            });
-        }
+        const policy = await this.reportedPolicy(machineId, self, hello.policy, rawPolicy);
         await this.db
             .updateTable("device_machines")
             .set({
@@ -237,6 +225,53 @@ let MachinesService = class MachinesService {
             .where("revoked_at", "is", null)
             .execute();
     }
+    /**
+     * Stores the local policy summary a connected program pushed after its hello (a `policy` frame:
+     * its policy file changed on the machine, its localhost proxy guard flipped, a new tier
+     * ceiling), read and audited as the hello's ({@link recordHello}): an unreadable summary keeps
+     * its isolation alone (`rawPolicy`), a changed isolation is audited `device.isolation_reported`.
+     * The next sandbox call then records a new `device_paths` event when the facts the model is told
+     * changed. A revoked machine is left alone.
+     */
+    async recordPolicy(machineId, summary, rawPolicy = summary) {
+        const self = await this.db
+            .selectFrom("device_machines")
+            .select(["device_id", "org_id", "account_id", "local_policy"])
+            .where("id", "=", machineId)
+            .where("revoked_at", "is", null)
+            .forUpdate()
+            .executeTakeFirst();
+        if (self === undefined)
+            return;
+        const policy = await this.reportedPolicy(machineId, self, summary, rawPolicy);
+        await this.db
+            .updateTable("device_machines")
+            .set({ local_policy: jsonOrNull(policy), last_seen_at: sql `now()` })
+            .where("id", "=", machineId)
+            .where("revoked_at", "is", null)
+            .execute();
+    }
+    /**
+     * The summary to store for one a program reported (hello or `policy` frame): the parsed one,
+     * else its raw isolation alone, else null. Audits `device.isolation_reported` when the isolation
+     * differs from the stored one (none stored counts as `sandbox`). Runs in the caller's
+     * transaction, with the machine's row locked.
+     */
+    async reportedPolicy(machineId, self, reported, rawPolicy) {
+        const summary = localPolicyOf(reported);
+        const isolation = summary?.isolation ?? isolationOf(rawPolicy);
+        const before = isolationOf(self.local_policy) ?? "sandbox";
+        if (isolation !== null && isolation !== before) {
+            await audit(this.db.db, {
+                actorAccountId: self.account_id,
+                orgId: self.org_id,
+                action: "device.isolation_reported",
+                target: self.device_id,
+                detail: { machineId, isolation, previous: before },
+            });
+        }
+        return summary ?? (isolation === null ? null : { isolation });
+    }
     /** Marks the machine seen (a ping); writes at most once every 60 seconds. */
     async touch(machineId) {
         await this.db
@@ -385,6 +420,9 @@ __decorate([
 __decorate([
     Transactional()
 ], MachinesService.prototype, "recordHello", null);
+__decorate([
+    Transactional()
+], MachinesService.prototype, "recordPolicy", null);
 __decorate([
     Transactional()
 ], MachinesService.prototype, "revoke", null);

package/dist/orgs/settings.controller.js

@@ -23,7 +23,7 @@ let OrgSettingsController = class OrgSettingsController {
     async get(org) {
         return {
             settings: await this.settings.get(org.orgId),
-            deployment: this.settings.deployment(),
+            deployment: await this.settings.deployment(),
             sandboxLimits: await this.settings.sandboxLimits(org.orgId),
         };
     }
@@ -32,7 +32,7 @@ let OrgSettingsController = class OrgSettingsController {
         return {
             // an API token may narrow the sandbox, never widen it (sandbox dev tiers spec §2)
             settings: await this.settings.update(org.orgId, body, p.account.id, patTokenId(p), undefined, { onlyNarrows: patTokenId(p) !== undefined }),
-            deployment: this.settings.deployment(),
+            deployment: await this.settings.deployment(),
             sandboxLimits: await this.settings.sandboxLimits(org.orgId),
         };
     }

package/dist/orgs/settings.service.d.ts

@@ -5,6 +5,7 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type PlatformTiers } from "../sandbox/platform-tiers.js";
 import { type EffectiveSandboxPolicy } from "../sandbox/tiers.js";
 import { OrgLock } from "./org-lock.js";
 /**
@@ -296,13 +297,15 @@ export declare class OrgSettingsService {
     config: Pick<KernelConfigService, "get">, log?: KernelLogger | undefined);
     /** Parses stored settings, warning when an invalid `sandboxTier` narrows to `{ max: "strict" }`. */
     private parseStored;
+    /** The platform's effective sandbox tiers (the startup config over the admin console's choice). */
+    platformTiers(): Promise<PlatformTiers>;
     /** 部署默认值（设置页展示「跟随部署」时的实际取值）。 */
-    deployment(): OrgSettingsDeployment;
+    deployment(): Promise<OrgSettingsDeployment>;
     /** 组织实际生效的沙箱 cpu / 内存（只读；由超级管理员在部署设置里覆盖）。 */
     sandboxLimits(orgId: string): Promise<OrgSandboxLimits>;
     get(orgId: string): Promise<OrgSettings>;
     /** The refusals of {@link update} that need no read of the org (the Platform tool's precheck). */
-    check(patch: OrgSettingsPatch): void;
+    check(patch: OrgSettingsPatch): Promise<void>;
     update(orgId: string, patch: OrgSettingsPatch, actorAccountId: string, actorTokenId?: string, 
     /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
     auditDetail?: Record<string, unknown>, 
@@ -313,8 +316,11 @@ export declare class OrgSettingsService {
     opts?: {
         onlyNarrows?: boolean;
     }): Promise<OrgSettings>;
-    /** The effective sandbox policy for the org's settings and a device's own tier (null = none). */
-    sandboxPolicy(settings: OrgSettings, deviceTier: SandboxTier | null): EffectiveSandboxPolicy;
+    /**
+     * The effective sandbox policy for the org's settings and a device's own tier (null = none);
+     * `tiers`: the platform's tiers when the caller already read them.
+     */
+    sandboxPolicy(settings: OrgSettings, deviceTier: SandboxTier | null, tiers?: PlatformTiers): Promise<EffectiveSandboxPolicy>;
     /**
      * Refuses a patch that widens the org's sandbox (sandbox dev tiers spec §2, §7.2: only a person
      * widens it, never the Platform tool or an API token):
@@ -327,7 +333,7 @@ export declare class OrgSettingsService {
      * - `sandboxEgress`: the base list grows: from none to anything else, or to hosts (the
      *   deployment's when the org gives none) not all in the current list.
      */
-    assertOnlyNarrows(before: OrgSettings, patch: OrgSettingsPatch): void;
+    assertOnlyNarrows(before: OrgSettings, patch: OrgSettingsPatch): Promise<void>;
     private updateIn;
 }
 /**